Synology Patches Critical NAS Flaws Allowing Unauthenticated File Access

Synology has patched eight vulnerabilities in DiskStation Manager (DSM), including two critical unauthenticated flaws affecting NAS devices. CVE-2026-13684, an output-encoding issue in the SCGI component, and CVE-2026-13639, an insufficient-entropy flaw in login logic, are both rated 9.8 on CVSS v3. A remote attacker could exploit either issue to read or write arbitrary files and cause denial-of-service conditions without logging in or interacting with a user.

The remaining six vulnerabilities include authenticated arbitrary-file-write flaws involving the LDAP and Upload APIs, plus issues involving CRLF injection, cross-site scripting and SQL injection. The XSS and SQL injection vulnerabilities require administrator privileges. The affected DSM branches are 7.2.1, 7.2.2, 7.3 and 7.4. Synology says it has no evidence of active exploitation and no public proof of concept is noted.

Synology’s advisory, SA_26_13, provides fixes in DSM 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9 and 7.2.1-69057-12 or later, with the appropriate build depending on the installed branch. The advisory lists no workaround, so administrators should update promptly and review their DSM version. The report also recommends limiting internet exposure of NAS devices and restricting administrative access.